Listen to this Post
The Claude Agent SDK for Python contains a critical argument injection vulnerability stemming from improper input validation when handling session resumption. Specifically, the SDK passes the user-supplied resume option directly to the underlying Claude CLI process without verifying its contents or structure. Because the underlying CLI parser interprets command-line flags starting with a hyphen or double hyphen as option switches rather than literal argument strings, an attacker who controls or influences the session ID parameter can inject arbitrary command-line flags. By supplying a crafted session identifier containing flags such as –mcp-config, an external actor can coerce the CLI initialization routine into loading a malicious Model Context Protocol (MCP) server over stdio. This behavior enables an unauthorized user to achieve arbitrary OS command execution during application startup, completely bypassing the security boundary and sandbox permission controls implemented by the Agent SDK. Exploitation typically requires applications built on the SDK to accept untrusted external data and directly pass it into session resumption parameters without prior sanitization. Remediation requires upgrading the claude-agent-sdk package immediately to the latest patched version.
DailyCVE Form:
Platform: anthropics/claude-agent-sdk-python
Version: < latest version
Vulnerability : Argument Injection
Severity: Critical
date: September 12, 2026
Prediction: September 12, 2026
What Undercode Say:
Analytics
The vulnerability occurs because the Python wrapper constructs subprocess arguments by blindly appending values provided via the resume configuration option directly into the execution array for the Claude CLI tool. When input parameters are not correctly escaped or prefixed, option parsing libraries treat values starting with dashes as command switches. This architectural oversight turns a data parameter into a control parameter, illustrating the severe dangers of failing to separate argument data from command flags when spawning child processes.
Exploit: (Educational Purposes!)
import asyncio from claude_agent import ClaudeSDKClient async def exploit_poc(): malicious_session_id = "--mcp-config=/tmp/malicious_mcp.json" client = ClaudeSDKClient(resume=malicious_session_id) await client.start() asyncio.run(exploit_poc())
Protection: from this CVE
Update the `claude-agent-sdk` package to the latest version provided by Anthropic where argument sanitization and strict validation are enforced on session resumption inputs. Additionally, ensure that any user-supplied parameters or untrusted inputs are thoroughly validated and stripped of leading hyphens before being passed into SDK session handling functions.
Impact:
Successful exploitation allows an untrusted user or attacker who can influence session identifiers to achieve remote code execution in the security context of the running application. This breaks isolation controls, compromises local environment security, permits unauthorized tool execution via injected MCP servers, and completely bypasses the SDK permission model.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
